What happened
On November 2, 2023, the deflationary token 3913 on BNB Smart Chain lost about $31,354 in a flash-loan skim attack, flagged by Decurity's Defimon monitor. The token was meant to reward new holders: its _transfer function paid a bonus whenever the PancakeSwap pair sent 3913 to a user, which was supposed to mean a USDT-to-3913 buy. But anyone can make a Pancake/Uniswap V2 pair send tokens to any address by calling skim(). The attacker flash-borrowed USDT, bought 3913, and kept sending 3913 into the pair and skimming it out, which paid out all the available bonuses.
According to DeFiHackLabs, the attacker used several transactions, of which the one below was the first.
Attacker: 0xb29f18b89e56cc0151c7c17de0625a21018d8ae7
Exploit transaction: 0x8163738d6610ca32f048ee9d30f4aa1ffdb3ca1eddf95c0eba086c3e936199ed
Attack contract: 0x783fbea45b32eaaa596b44412041dd1208025e83
How it happened
- The attack contract took nested flash loans of BSC-USD (USDT) from five DODO pools.
- It bought 3913, and a small amount of the related token 9419, through PancakeRouter, and deployed a helper contract to receive the pair's transfers.
- It sent 1 wei of USDT and its whole 3913 balance into the 3913/USDT pair, then called
skim()with the helper as recipient. The pair pushed the surplus 3913 out, and the token treated this as a pair-to-user buy and credited a bonus. - In a loop of ten iterations it pulled the tokens back from the helper and, while a balance check on address
0x570C...F015held, repeated the transfer-and-skim()cycle, growing its 3913 balance with each round of bonuses. When the check failed, that iteration called the token'sburnPairs()instead, so the cycle ran up to ten times. - It sold the inflated 3913 into the USDT pair and through the 3913/9419 pair, swapped the 9419 to USDT, repaid the flash loans, and kept the profit, about $31,354 in total according to DeFiHackLabs.
Protocol details
Evidence
- report Decurity thread on the 3913 skim attack (via fxtwitter API) twitter.com
- transaction bscscan.com transaction 0x8163…99ed bscscan.com
- address bscscan.com address 0x783F…5E83 bscscan.com
- address bscscan.com address 0xb29F…8ae7 bscscan.com
- analysis DeFiHackLabs PoC 3913_exp.sol raw.githubusercontent.com
- analysis DeFiHackLabs 2023 incident list raw.githubusercontent.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
